| Título | quequnlong shiyi-blog 1.0.0 through 1.2.1; source through 4db96f9 Cross Site Scripting |
|---|
| Descrição | A stored cross-site scripting vulnerability affects quequnlong shiyi-blog releases 1.0.0 (commit 9badd7bbe95fbee1dcdaa31156cf398caefe722d), 1.2 (commit d69c5ebc2c9a74e83473a6fb7c542b3801b8ac04), 1.2.1 (commit 3ef9143fcf37c8fc8ec13241ef44f23c084d2554), and current source through commit 4db96f9ad6fdb53122e06610d8c3d55e88c5a580. A user assigned the granular sys:article:add or sys:article:update permission can persist controlled SysArticle.title or SysArticle.summary values through POST /sys/article/add or PUT /sys/article/update. The normal portal editor presents title as a plain input and summary as a plain textarea rather than rich-text fields. SysArticleServiceImpl copies and stores these fields in sys_article without an HTML allowlist sanitizer. In the normal workflow the author submits a draft or review item and a separate user with publication authority can set the article to published status; the unauthenticated GET /api/article/list endpoint returns only published status=1 articles. blog-web/src/components/Search/index.vue truncates the raw title or summary, highlightKeyword inserts mark elements without first encoding the source string, and the component renders both results through Vue v-html. An anonymous or ordinary visitor who searches for and matches the published article therefore renders the persisted content in the shiyi-blog origin. The initialization SQL does not show that every registered portal user has article write permission, so this report does not make that claim. The project explicitly supports dynamic RBAC, custom roles, granular menu permissions, and role assignment to separate users, so article authoring can be delegated independently from publication and from the final visitor. Cross-account harmless triggering was confirmed in an authorized test environment; no executable payload is included. This is not self-XSS. CWE-79. Suggested CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4). Product source: https://gitee.com/quequnlong/shiyi-blog . Public vendor report: https://gitee.com/quequnlong/shiyi-blog/issues/IK5SPD . This root is independent from CVE-2025-5513 (/api/comment/add and comment rendering), Issue IK5RF6 (/api/message/add, sys_message, administrator message-management page), Issue IK5RVL (/chat/sendMsg, chat_msg, global chat page), and Issue IK5RZG (/sys/notice/add|update, sys_notice, public notice sidebar). The input endpoints, stored fields, victim component, and fix locations are distinct. |
|---|
| Fonte | ⚠️ https://gitee.com/quequnlong/shiyi-blog/issues/IK5SPD |
|---|
| Utilizador | JunRoinxxX (UID 100281) |
|---|
| Submissão | 01/08/2026 11h43 (há 1 mês) |
|---|
| Moderação | 12/09/2026 17h57 (1 month later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 403152 [quequnlong shiyi-blog até 1.2.1 Search index.vue highlightKeyword title/summary Script de Site Cruzado] |
|---|
| Pontos | 20 |
|---|